- When --source/--pod is used, automatically generate the .ssp
  document abstraction and bundle it into the pod at
  media/abstraction/{doc_uid}.{lang}.ssp

- This makes show_abstraction implicitly true when source_or_pod
  is active, so the .ssp file is generated before the pod
  assembler runs (abstraction runs before outputHub, and
  source_or_pod is the first task in outputHub).

- Changes:
    paths_source.d:
      Add abstraction_root() path helper to _PodPaths struct,
      following the same pattern as image_root(). Produces
      paths like pod/media/abstraction/ for both zpod (inside
      zip) and filesystem_open_zpod (open directory).

    source_pod.d:
      - Create media/abstraction/ directory in
        podArchive_directory_tree
      - Bundle .ssp file in pod_zipMakeReady: reads from the
        abstraction output directory, copies to open pod
        directory, adds to zip archive, computes SHA-256 digest
      - Write .ssp digest in zipArchiveDigest alongside sstm
        and ssi digests

    spine.d:
      Make show_abstraction() return true when source_or_pod is
      active (previously only returned true for explicit
      --show-abstraction flag).

- The .ssp is always included when building pods - no exclusion
  flag for this experimental feature to keep things simple.
  Not generated for non-pod outputs (--text, --html, etc.)
  unless --show-abstraction is explicitly passed.

- Tested against all 35 sample documents - zero failures.

  Co-Authored-By: Anthropic Claude Opus 4.6 (1M context)

- claude contributed src
  - processes zip from url using (system
    installed) curl for download

- claude contributed src
  - Opens the zip with std.zip.ZipArchive (reads the whole file into
    memory)
  - Locates pod.manifest inside the archive to discover document paths
    and languages
  - Extracts markup files (.sst/.ssm/.ssi) as in-memory strings
  - Extracts images as in-memory byte arrays
  - Extracts conf/dr_document_make if present
  - Presents these to the existing pipeline as if they were read from
    the filesystem
  - Some security mitigations:
    - Zip Slip / Path Traversal: Reject entries containing `..` or
      starting with `/`; canonicalize resolved paths and verify they
      fall within extraction root
    - Zip Bomb: Check `ArchiveMember.size` before extracting; enforce
      per-file (50MB) and total size limits (500MB)
    - Entry Count: Limit number of entries (a pod should have at most
      ~100 files)
    - Path depth: limit (Maximum 10 path components).
    - Symlinks: Verify no symlinks in extracted content before
      processing (post-extraction recursive scan)
    - Filename Validation: Only allow expected characters; reject null
      bytes
    - Malformed Zips: Catch `ZipException` from `std.zip.ZipArchive`
      constructor
    - Cleanup on error

- appears to work, but needs review

- tics a bit cumbersome where single quotes work
  just as well
- testing required (special cases not covered)
- diverges from sisu markup which will need an
  update sometime